[Deps] Safe dependency updates (2026-06-23)

[github-actions]

Automated Safe Dependency Updates

This PR contains safe dependency updates (within declared semver ranges) that have been verified to:

• ✅ Pass all tests (3053 passing; 1 pre-existing failure unrelated to dependencies)
• ✅ Have no breaking changes within their semver constraints
• ✅ Address known security advisories (where noted)

Updated Dependencies

Package	Previous	Updated	Type	Notes
@babel/core	7.29.0	7.29.7	patch	Fixes LOW security advisory: Arbitrary File Read via sourceMappingURL
@babel/preset-env	7.29.2	7.29.7	patch
@commitlint/cli	20.5.0	20.5.3	patch
@commitlint/config-conventional	20.5.0	20.5.3	patch
@eslint/compat	2.0.5	2.1.0	minor
@types/node	25.6.0	25.9.4	minor
@typescript-eslint/*	8.58.2	8.62.0	minor	eslint-plugin, parser, typescript-eslint
ajv	8.18.0	8.20.0	minor	prod dependency
babel-jest	30.3.0	30.4.1	minor
eslint	10.2.1	10.5.0	minor
globals	17.5.0	17.7.0	minor
jest	30.3.0	30.4.2	minor
js-yaml	4.1.1	4.2.0	minor	prod dependency; fixes MODERATE DoS advisory (merge key aliases)
ts-jest	29.4.9	29.4.11	patch

Security Fixes Included

• @babel/core 7.29.7: Fixes GHSA-4x5r-pxfx-6jf8 — Arbitrary File Read via sourceMappingURL Comment (LOW, CVSS 3.2, dev-only)
• js-yaml 4.2.0: Addresses MODERATE DoS vulnerability — Quadratic-complexity DoS in merge key handling via repeated aliases (dev-only transitive dependency)

Vulnerability Assessment

Severity	Count	Action
CRITICAL	0	—
HIGH	0	—
MODERATE	19 (dev-only)	Noted; require major version bumps to fix fully
LOW	1 (dev-only)	Fixed by @babel/core 7.29.7 in this PR

Verification

• All 3053 tests pass
• No breaking changes detected
• Pre-existing test failure (agent-volumes-mounts DNS IP mismatch) confirmed unrelated to these dependency changes

Notes

Only package-lock.json is modified. package.json version ranges already cover these updates (npm update applied all within-range updates). The remaining MODERATE vulnerabilities require major version upgrades (jest 25.x, babel-jest 25.x) which represent breaking changes and are out of scope for this automated PR.

---

Generated by Dependency Security Monitor Workflow

---

Warning

Protected Files — Push Permission Denied

This was originally intended as a pull request, but the patch modifies protected files. A human must create the pull request manually.

Protected files

• package-lock.json

The push was rejected because GitHub Actions does not have workflows permission to push these changes, and is never allowed to make such changes, or other authorization being used does not have this permission.

Create the pull request manually

# Download the patch from the workflow run
gh run download 28008490685 -n agent -D /tmp/agent-28008490685

# Create a new branch
git checkout -b deps/safe-updates-2026-06-23-c9125aa803127713 main

# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-28008490685/aw-deps-safe-updates-2026-06-23.patch

# Push the branch and create the pull request
git push origin deps/safe-updates-2026-06-23-c9125aa803127713
gh pr create --title '[Deps] Safe dependency updates (2026-06-23)' --base main --head deps/safe-updates-2026-06-23-c9125aa803127713 --repo github/gh-aw-firewall

Generated by Dependency Security Monitor · 58.2 AIC · ⊞ 8.3K · ◷